CVE-2021-25735: Access Restriction Bypass in kube-apiserver
Summary
CVE-2021-25735: Access Restriction Bypass in kube-apiserver. Affects k8s.io/kubernetes across 3 version ranges.
< 1.18.18
>= 1.19.0, < 1.19.10
>= 1.20.0, < 1.20.6
Fixed in 1.18.18, 1.19.10 or 1.20.6, depending on the release line you run. How to fix ↓
Also tracked for
- kubernetes · Debian:11
The same CVE-2021-25735 is tracked separately for each ecosystem and vendor. Its fix information is the same; the package and affected versions differ.
Check if this vulnerability affects your application
Upload a manifest or SBOM and we'll show whether you're affected, plus every other risky package in the same scan.
No signup required · Results in about 60 seconds
Background
The kube-apiserver is a component of Kubernetes that provides the API interface for managing the cluster. It is responsible for validating and processing requests from various Kubernetes components. This vulnerability affects versions 1.18.17 to 1.20.5 of the k8s.io/kubernetes package written in Go. The vulnerability allows unauthorized node updates to bypass a Validating Admission Webhook, potentially leading to the acceptance of requests that should be blocked.
Vulnerability Detail
The vulnerability arises when an update action on node resources is performed and an admission controller is in place to validate the action. The admission controller receives information that may contain old configurations, which can overwrite values used for validation. As the overwriting occurs before the validation, the admission controller may accept requests that should be denied. This vulnerability only affects users running a Validating Admission Webhook for Nodes that denies admission based on the old state of the Node object. It does not impact calls from kubelets that go through the built-in NodeRestriction admission plugin. The vulnerability has a CVSS score of 6.5 (CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:N/I:H/A:H).
How To Fix
Latest published version: v1.37.1 as of 23 Oct 2026
go get k8s.io/kubernetes@v1.37.1Upgrading to it may include breaking changes; the versions below are the minimum fixed release for this vulnerability.
If you can't move to the latest
The minimum fixed version depends on the release line you run.
-
< 1.18.181.18.18go get k8s.io/kubernetes@v1.18.18 -
>= 1.19.0, < 1.19.101.19.10go get k8s.io/kubernetes@v1.19.10 -
>= 1.20.0, < 1.20.61.20.6go get k8s.io/kubernetes@v1.20.6
Tip — Not sure which release line you're on? Vulert can find the fix for the version you are using. Scan free →
Workaround
There is no known workaround for this vulnerability.
Conclusion
In conclusion, the CVE-2021-25735 vulnerability in kube-apiserver allows unauthorized node updates to bypass validation, potentially leading to the acceptance of requests that should be blocked. Users should upgrade to the fixed versions of the k8s.io/kubernetes package to mitigate this vulnerability. For further support on vulnerability remediation, please contact DevNack.com.
See every vulnerability recorded for k8s.io/kubernetes →
FAQ
This vulnerability allows unauthorized node updates to bypass validation, potentially leading to the acceptance of requests that should be blocked. It only affects clusters running a Validating Admission Webhook for Nodes that denies admission based on the old state of the Node object.
No, only versions 1.18.17 to 1.20.5 are affected.
No, there is no known workaround for this vulnerability.
The CVSS score of this vulnerability is 6.5 (CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:N/I:H/A:H).
You can use Vulert's playground at Vulert Scanner to check if your application is affected by this vulnerability. Vulert monitors and alerts in real-time for open-source vulnerabilities without requiring access to the code or installation.
References
Related vulnerabilities
Recent vulnerabilities recorded for k8s.io/kubernetes.
